Netgate 3100 - v25.11.1 - Sudden flood (228 messages A SECOND) of DHCPv6 syslogs
-
Netgate 3100 - v25.11.1 - Sudden flood (5 GB) of DHCPv6 syslogs
All of the sudden, our Netgate 3100 started producing Gigabytes of SYSLOG messages (228 messages a second).
It consumed our total allotment/allowance of cloud SYSLOG storage (PaperTrailLog)I realize this is a few versions behind on software version - but we are unable to do remote upgrades anymore.
I will upgrade on my next visit to this remote location.Can anyone advised on what happened here:
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0x96453000
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy
:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1421 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5779
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0xB2298200
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0x954B1100
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0xAE588A00
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0x74C45200
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Rebind message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0xA1259600
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0xE2BB100
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546
Apr 18 09:29:13 AM dhcpd Renew message from fe80::xxxx:yyyy:zzzz:4f70 port 546, transaction ID 0x765F8900
Apr 18 09:29:13 AM dhcpd Reply NA: address 2600:xxxx:yyyy:2991 to client with duid 00:03:00:01:a0:8c:fd:5d:4f:70 iaid = 3 valid for 7200 seconds
Apr 18 09:29:13 AM dhcpd Reusing lease for: 2600:xxxx:yyyy:2991, age 1422 secs < 25%, sending shortened lifetimes - preferred: 1, valid 5778
Apr 18 09:29:13 AM dhcpd Sending Reply to fe80::xxxx:yyyy:zzzz:4f70 port 546 -
From just that it looks like that one client device spamming the server for some reason.
You can likely add a custom option to reject those at less than a minimal interval but it might still log something.
Can you see those requests in a pcap?
-
I will not be able to get pcap as this is something that happened last week.
It occurred over a period of a few days, and our logging server locked-out the pfSense for exceeding the storage quota.
I will try to find what piece of office equipment was causing this.
I know very little about IPv6, but will enlist chatgpt to help me.
Privacy Policy · Cookie Policy